4.2.1xx游戲驅(qū)動保護代碼書寫-49課

1、4.2.1 XX驅(qū)動保護代碼書寫-49課A、定位特征碼函數(shù)FindCode_Address構(gòu)建 B、定位NtOpenThreadC、定位NtOpenProsD、定位NtReadVirtualMemory E、定位NtWriteVirtualMemory F、CALL與JMP指令的區(qū)別G、構(gòu)建相應的替換函數(shù):39分OpenPro OpenThreads/NtOpenPros+0 x21E /SSDT 122/NtOpenThread+0 x214/SSDT 128RerosMemory sMemory/NtReadVirtualMemory+0/NtWriteVirtualMemory+0/SS

2、DT/SSDT186277WriteProRe mov jmprosMemoryeax,Proc eaxWriteProsMemorymov eax,Proc2 jmp eaxWriteProsMemory+7#pragma PAGECODE declspec(naked)VOID/恢復前2條指令 asmpush1ChMy_RerosMemory()#pragma PAGECODE declspec(naked)VOID_OpenPros() asmpush push mov add push/ jmpdword ptr ebp-38h dword ptr ebp-24h eax,ntopen

3、prcaddr eax,0bheax /CALL后返回的地址 非壓棧參數(shù)ObOpenObjectByPoeraddr=筆記:上節(jié)課有個函數(shù)寫錯了,應該是 NtDebugActivePros.將 46 課的源代碼過來,新建一個49.H 頭文件.首先通過 NtReadVirtualMemory 函數(shù),建立函數(shù)先恢復前面幾個字節(jié),然后再跳回sMemory 也寫上恢復代碼.再寫nOpenPros 函數(shù)的恢復,但是到原函數(shù).同理WritePro這個不能在頭部直接恢復,是要在后面偏移 0X21E 處修改. n人不明白匯編又講解call = push + jmp 的原理.最終代碼如下:OpenThread

4、的方法也類似.怕有/nReadVirtualMemory:/805b528a 6a1cpush1Ch push/805b528c 68e8ae4d80 (804daee8)offset nt!MmClaimParameterAdjustDownTime+0 x90DWORD Real_NtReadVirtualMemory_7 =0 x805b5291; DWORD Real_NtWriteVirtualMemory_7=0 x805b5394;DWORD NtOpenPros_21E=0 x805cc61a; /myNtOpenProsDWORD NtOpenThread_214=805cc

5、89ch;/myNtOpenThreadDWORD NtOpenThread_214_B=805cc8a7h;DWORD NtOpenPros_21E_B=805cc625h; #pragma PAGECODE declspec(naked)VOID My_NtReadVirtualMemory()/恢復前 2 條指令 asmpush puhs1Ch 804daee8hjmpReal_NtReadVirtualMemory_7#pragma PAGECODE declspec(naked)VOID My_NtWriteVirtualMemory()/恢復前 2 條指令/nWriteVirtua

6、lMemory:/ 805b5394 6a1cpush1Ch push/ 805b5396 6800af4d80 (804daf00)offset nt!MmClaimParameterAdjustDownTime+0 xa8 asmpush puhs jmp1Ch 804daf00hReal_NtWriteVirtualMemory_7/ OpenPros/NtOpenPros+0 x21E s+0 x21e:/SSDT 122/ nOpenPro/ 805cc61a ff75c8/ 805cc61d ff75dcpush push callmovdword ptr ebp-38h /jmp

7、 My_NtOpenPrcoess dword ptr ebp-24h/ 805cc620 e84706f/ 805cc625 8bf8 #pragma PAGECODEnt!ObOpenObjectByPo edi,eaxer (805bcc6c) declspec(naked)VOID My_NtOpenPrcoess()/恢復前 2 條指令/nWriteVirtualMemory:/ 805b5394 6a1cpush push1Choffset nt!MmClaimParameterAdjustDownTime+0 xa8/ 805b5396 6800af4d80(804daf00)

8、asmpush push push jmp/jmpdword ptr ebp-38h dword ptr ebp-24hNtOpenPros_21E_B /DWORD NtOpenPros_21E_B=805cc625hObOpenObjectByPoer /*(805bcc6c)*/ ret c3 eipNtOpenPros_21E_B/ OpenThread/805cc89cff75cc/NtOpenThread+0 x214push/SSDT 128dwordptrebp-34h/jmpDWORDNtOpenThread_214=805cc89ch;/ 805cc8975e0pushdw

9、ord ptr ebp-20h nt!ObOpenObjectByPoedi,eax/ 805cc8a2 e8c503/ 805cc8a7 8bf8fcaller (805bcc6c)mov#pragma PAGECODE declspec(naked)VOID My_NtOpenThread()/恢復前 2 條指令/nWriteVirtualMemory:/ 805b5394 6a1cpush push1Choffset nt!MmClaimParameterAdjustDownTime+0 xa8/ 805b5396 (804daf00)6800af4d80 asmpush push pu

10、sh jmpdword ptr ebp-34h dword ptr ebp-20hNtOpenPros_214_B / DWORD NtOpenPros_214_B=805cc8a7hObOpenObjectByPoer /*(805bcc6c)*/jmpNtOpenPros_214_B#pragmaPAGECODE VOID HOOK()/ SSDT 186 =My_NtReadVirtualMemory/ SSDT 277 =My_NtWriteVirtualMemory/DWORD NtOpenPros_21E=0 x805cc61a; /myNtOpenPros/DWORD NtOpenThread_214=805cc89ch; asm/myNtOpenThread/ NtOpenPros 還原lea ebx,NtOpenPro mov ebx+0,E9hlea eax,m